MediaTek patches 57 flaws, including six critical modem bugs

MediaTek published its November 2026 product security bulletin, fixing 57 security flaws across multiple chipset architectures. The update covers six critical vulnerabilities in the cellular modem components that enable remote privilege escalation. Device manufacturers will need to roll out firmware updates through their smartphone and device builders to protect end users. The vulnerability tally lists 25 CVEs overall, with 25 marked as Unrated and no confirmed active exploitation at the time of the bulletin.

The highest severity is still awaiting analysis, identified as CVE-2026-20499. MediaTek notes that it notified device manufacturers two months ahead of public release, and that there is no known active exploitation in the wild, with no public PoCs reported by independent researchers.

The bulletin details six critical modem flaws linked to improper input validation, integer overflows, and missing bounds checks in baseband processing. An attacker operating a rogue cellular base station could transmit malformed radio frames to trigger an out-of-bounds write in the baseband processor, enabling remote privilege escalation without user interaction. In addition to the modem, MediaTek patched 16 high-severity and 35 medium-severity flaws across peripheral subsystems.

Notable CVEs include CVE-2026-20562 and CVE-2026-20563 (remote denial of service via malformed network traffic) and CVE-2026-20552 (out-of-bounds writes in the Cross Core Communication Interface driver). Affected models span MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, with older Helio and automotive chipsets such as MT6768, MT6789, MT2735, and MT2737 remaining vulnerable until patched. Manufacturers are advised to apply the latest updates promptly.